From 3bcb096a0e3db7bcb09cef4dd938e6d80a86a147 Mon Sep 17 00:00:00 2001 From: Matthijs Mekking Date: Tue, 11 Jul 2023 14:51:24 +0200 Subject: [PATCH] Tiny refactor revoked key check This makes the code flow a bit more readable. --- lib/dns/update.c | 49 +++++++++++++++++++--------------------- lib/dns/zone.c | 59 +++++++++++++++++++----------------------------- 2 files changed, 46 insertions(+), 62 deletions(-) diff --git a/lib/dns/update.c b/lib/dns/update.c index 6063a50199..6d7e563c0f 100644 --- a/lib/dns/update.c +++ b/lib/dns/update.c @@ -1160,17 +1160,6 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db, continue; } - if (!REVOKE(keys[i])) { - /* - * Don't consider inactive keys, however the KSK may be - * temporary offline, so do consider KSKs which private - * key files are unavailable. - */ - both = dst_key_have_ksk_and_zsk( - keys, nkeys, i, false, KSK(keys[i]), - !KSK(keys[i]), NULL, NULL); - } - if (use_kasp) { /* * A dnssec-policy is found. Check what RRsets this @@ -1216,26 +1205,34 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db, */ continue; } - + } else if (!REVOKE(keys[i])) { /* - * If this key is revoked, it may only sign the - * DNSKEY RRset. + * Don't consider inactive keys, however the KSK may be + * temporary offline, so do consider KSKs which private + * key files are unavailable. */ - if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) { - continue; - } - } else if (both) { - /* - * CDS and CDNSKEY are signed with KSK (RFC 7344, 4.1). - */ - if (dns_rdatatype_iskeymaterial(type)) { - if (!KSK(keys[i])) { + both = dst_key_have_ksk_and_zsk( + keys, nkeys, i, false, KSK(keys[i]), + !KSK(keys[i]), NULL, NULL); + if (both) { + /* + * CDS and CDNSKEY are signed with KSK (RFC + * 7344, 4.1). + */ + if (dns_rdatatype_iskeymaterial(type)) { + if (!KSK(keys[i])) { + continue; + } + } else if (KSK(keys[i])) { continue; } - } else if (KSK(keys[i])) { - continue; } - } else if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) { + } + + /* + * If this key is revoked, it may only sign the DNSKEY RRset. + */ + if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) { continue; } diff --git a/lib/dns/zone.c b/lib/dns/zone.c index 4b07ae6699..5f284829d0 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -6596,16 +6596,6 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone, continue; } - if (!REVOKE(keys[i])) { - /* - * Don't consider inactive keys, however the KSK may be - * temporary offline, so do consider keys which private - * key files are unavailable. - */ - both = dst_key_have_ksk_and_zsk( - keys, nkeys, i, false, KSK(keys[i]), - !KSK(keys[i]), NULL, NULL); - } if (use_kasp) { /* * A dnssec-policy is found. Check what RRsets this @@ -6665,26 +6655,34 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone, */ continue; } - + } else if (!REVOKE(keys[i])) { /* - * If this key is revoked, it may only sign the - * DNSKEY RRset. + * Don't consider inactive keys, however the KSK may be + * temporary offline, so do consider keys which private + * key files are unavailable. */ - if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) { - continue; - } - } else if (both) { - /* - * CDS and CDNSKEY are signed with KSK (RFC 7344, 4.1). - */ - if (dns_rdatatype_iskeymaterial(type)) { - if (!KSK(keys[i])) { + bool both = dst_key_have_ksk_and_zsk( + keys, nkeys, i, false, KSK(keys[i]), + !KSK(keys[i]), NULL, NULL); + if (both) { + /* + * CDS and CDNSKEY are signed with KSK (RFC + * 7344, 4.1). + */ + if (dns_rdatatype_iskeymaterial(type)) { + if (!KSK(keys[i])) { + continue; + } + } else if (KSK(keys[i])) { continue; } - } else if (KSK(keys[i])) { - continue; } - } else if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) { + } + + /* + * If this key is revoked, it may only sign the DNSKEY RRset. + */ + if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) { continue; } @@ -9279,17 +9277,6 @@ zone_sign(dns_zone_t *zone) { /* * We do KSK processing. */ - if (!REVOKE(zone_keys[i])) { - /* - * Don't consider inactive keys, however the key - * may be temporary offline, so do consider KSKs - * which private key files are unavailable. - */ - both = dst_key_have_ksk_and_zsk( - zone_keys, nkeys, i, false, - KSK(zone_keys[i]), !KSK(zone_keys[i]), - NULL, NULL); - } if (use_kasp) { /* * A dnssec-policy is found. Check what